Merge SPF records and count DNS lookups (10 limit)

Keep one record, put every sender from both into it, and end it with a single all. Then delete the second record.

• Formula: v=spf1 + every include, ip4, ip6, a and mx from both records + one all
• Drop the second “v=spf1” and the first “all”. RFC 7208 says anything after “all” is ignored.
• Remove duplicates. The same include listed twice still costs lookups twice.

Example: v=spf1 include:_spf.google.com ~all and v=spf1 include:secureserver.net -all become v=spf1 include:_spf.google.com include:secureserver.net ~all.

Your domain has more than one TXT record that starts with v=spf1. RFC 7208 section 4.5 says that gives a “permerror”, so SPF fails for every message.

• GoDaddy: Domain Portfolio > your domain > DNS. Edit one v=spf1 record, paste the merged value, delete the others, then save.
• Squarespace: Domains > your domain > DNS. Click the pencil on one v=spf1 record, paste into Data, and delete the others with the trash can.
• Any other host: same idea. Some hosts call the Name field Host, and @ means the domain itself.

Example: a shop adds GoDaddy email next to Google Workspace and pastes GoDaddy’s record as a new TXT record. Both mailboxes start failing SPF until the two are merged.

Count each include, a, mx, ptr, exists and redirect, then add the lookups inside every include. RFC 7208 section 4.6.4 caps the total at 10; above that, SPF fails.

• Formula: lookups = terms in your record + terms inside each include, all the way down
• ip4, ip6 and all count zero.
• Fewer than 10 includes does not mean fewer than 10 lookups, Microsoft notes.

Example: an include that holds three more includes costs 1 + 3 = 4. Add a second include that holds one more, and the record uses 4 + 2 = 6.

A lookup that comes back with no record, or a name that does not exist. RFC 7208 says receivers should allow two; a third gives a permerror.

• The usual cause is an include for a service you stopped using.
• An include whose name has no SPF record also fails SPF on its own.
• The tool leaves those out of the merged record and tells you which ones.

Example: include:mail.oldcrm.example points at a CRM that shut down. The name no longer exists, so it counts as one void lookup and breaks SPF.

Remove what no longer sends, then move bulk senders to a subdomain with its own record. Each subdomain gets its own 10.

• Untick services you have stopped using.
• Send newsletters from a subdomain such as news.yourbusiness.com, as Microsoft suggests.
• Replace an include with ip4 ranges only when the vendor publishes stable addresses. Microsoft says not to do this for Microsoft 365, whose addresses change often.

Example: five includes that cost 4, 2, 2, 2 and 2 lookups total 12. Moving three of the 2-lookup senders to a subdomain brings the main record to 6.

To see whether DKIM and DMARC are in place too, run the invoices going to spam checker. Setting up sending across every tool is one of our fixes.